From 8dd9e117bcd3597f800cef4a0f13718c9feead79 Mon Sep 17 00:00:00 2001 From: Paul Payne Date: Tue, 14 Jul 2026 12:10:49 +0000 Subject: [PATCH] Fix cert auto-provisioning to check wildcard coverage before provisioning The auto-provisioner was checking for individual cert files (e.g., git.civilsociety.dev.pem) without checking if a wildcard cert already covers the domain (*.civilsociety.dev.pem). This caused redundant individual certs to be provisioned for domains already covered by a wildcard. Now uses hasCertForDomain() which checks both individual AND wildcard cert coverage before deciding a cert is missing. --- internal/reconcile/reconciler.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/internal/reconcile/reconciler.go b/internal/reconcile/reconciler.go index 9653447..5647e1a 100644 --- a/internal/reconcile/reconciler.go +++ b/internal/reconcile/reconciler.go @@ -431,19 +431,21 @@ func (r *Reconciler) ensureTLSCerts(globalCfg *config.State, doms []domains.Doma gatewayDomain = parts[1] } - // Collect unique missing certs (wildcard or individual) + // Collect unique missing certs. Use hasCertForDomain which checks + // both individual certs AND wildcard coverage (e.g., *.civilsociety.dev + // covers git.civilsociety.dev — no individual cert needed). missing := map[string]bool{} for _, dom := range doms { if dom.TLS != domains.TLSTerminate || dom.DomainName == "" { continue } - if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) { - if _, err := os.Stat(certbot.HAProxyCertPath(gatewayDomain)); err != nil { - missing["*."+gatewayDomain] = true - } + if hasCertForDomain(dom.DomainName) { continue } - if _, err := os.Stat(certbot.HAProxyCertPath(dom.DomainName)); err != nil { + // Determine what cert to provision: wildcard for gateway subdomains, individual otherwise + if gatewayDomain != "" && strings.HasSuffix(dom.DomainName, "."+gatewayDomain) { + missing["*."+gatewayDomain] = true + } else { missing[dom.DomainName] = true } }